chore(release): prepare 1.5.0

[dknauss]

Version bump and changelog prep for 1.5.0. No functional code changes — every source change in this release already landed on main.

Why minor, not patch

The Block Accessibility Checks integration now requires BAC 4.0. On BAC 3.x the v4 registration function is absent, so the integration stays dormant and the four bibliography checks silently stop appearing. That's a behavior change for existing users, not a fix, and 1.4.3 would undersell it. Borges itself is unaffected whether BAC is outdated or absent.

Version bumped in five places

bibliography-builder.php header, block.json, package.json, package-lock.json (both the top-level and packages."" entries), and the readme Stable tag. Verified stamped correctly inside the built zip, not just in source.

readme.txt had no security entries

CHANGELOG.md documented six; readme.txt listed none of them. That file is what installed users and WordPress.org readers actually see, and this is substantially a security release. All six are now there in user-facing language, with the section flagged at the top and the unauthenticated issue leading:

• GET /posts/{id}/bibliographies?format=text stripped stored citation text with no length bound. Past ~600 KB core's script/style regex degrades to catastrophic backtracking — ~12s of pinned CPU per read, on a route requiring no authentication and repeatable at no cost to the caller.
• Non-public post types were readable without authentication; published status alone satisfied the check.
• Citation links are now restricted to http/https.
• Plus the formatter-side length cap, wp_safe_remote_get() for PMID lookups, and U+2028/U+2029 escaping.

I kept the changelog's framing that the U+2028/U+2029 fix is not an XSS issue — ld+json is never executed. Worth a second look, since a Security: prefix on wp.org gets read with more alarm than that one warrants.

Added the missing Upgrade Notice at 291 characters, under wp.org's 300 guidance.

Verification

Jest 678 passing, PHPUnit 190 passing, Psalm and PHPCS exit 0, lint:js/lint:css/lint:i18n clean, composer verify:metrics matching, npm audit --omit=dev and composer audit --no-dev both clean, npm run build and npm run package:release producing a 463K zip with no dev metadata.

One local-only snag worth recording: composer test:php initially failed 6 StyleYearRenderingTest cases, but only against the vendor/ copies of Chicago-notes, MLA, and OSCOLA — never the committed packages/ sources. A stale June 14 vendor mirror still carried the unrenderable variable="issued" form="text". Reinstalling the path package cleared it. Nothing in the repo was wrong; that test's dual source/rendered provider did its job.

Dependabot #73

Checked against the typescript pin from 8945eeb. No conflict: #73 touches only package-lock.json, leaving the typescript: ~5.3.3 override in package.json intact, and its regenerated lockfile resolves typescript to 5.3.3 with zero @typescript/* platform binaries — exactly what the pin was meant to enforce. websocket-driver stays at 0.7.5. It also merges cleanly against this branch. Safe either before or after this release.

Not covered here

The manual sections of docs/release-readiness-checklist.md — editor QA, frontend/output QA, accessibility, data integrity, and the Studio sample pages (post=12/14/15). The http/https allowlist changes link rendering, so the frontend output checks are more load-bearing than usual this time.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.05%. Comparing base (62f659c) to head (4ecacf3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #77   +/-   ##
=======================================
  Coverage   81.05%   81.05%           
=======================================
  Files          43       43           
  Lines        3151     3151           
  Branches      523      523           
=======================================
  Hits         2554     2554           
  Misses        191      191           
  Partials      406      406           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.